WebView Attack Lab

1. Objectives

This lab designed for students who have the computer science background or is interesting in computer security problems. After the lab, students will have a deeper and more comprehensive understanding of WebView attack. The JavaScript Code Injection will be realized in this experiments. We provide a malicious app which called Capture.akp and the corresponding project package to students. It is should be point out that this project package is not completed version. Students should add the malicious code by them self then get the app could run the same function like the example Capture.apk. They could try and test how to execute the JavaScript Code injection attack and then add the malicious code to application.

2. Pre-lab Reading

The other one is “Attacks on WebView in the Android System” by Luo et al. [2] discussed a number of attacks on WebView. Those attacks could be divided in two type. One is the attack from malicious apps, other one is the attack form web pages. This lab design based on the first one. The section 2 (Short Tutorial on WebView) indicate the basic knowledge which students need to learn to finish this lab. The examples in this lab are derived from this paper.

3. Experiment

In the following, brief instructions are given on

1) how to execute the attack;

2) how to set up project into Eclipse;

3) add malicious code to the “uncompleted” project;

4) how to test an attack success or not.

There are two choices in this part. One choice is use Android virtual machine which is provided by Eclipse. The other one is that implement the attack by a real mobile device. Both of them could get the same result. The students could choose either one by convenient.

1. 
   Android virtual machine
   

1. 
   Download the Android Software Development Kit (SDK)
   

2. 
   Download Eclipse IDE for Java Developers
   

3. 
   Install the Android Development Tools (ADT) plugin
   

1. 
   Choose “Help” > “Install New Software….”
   
2. 
   Click the “Add…” button and create a new entry:
   
   • 
     Name: “Android ADT” (this space is for your own personal use, so name it whatever you want)
     
   • 
     Location: “https://dl-ssl.google.com/android/eclipse/” (try just http:// if the https:// does not work)
     
3. 
   Check all the boxes to install all the tools
   
4. 
   Just keep clicking “I agree”, “Next”, “Yes”, etc. until it asks you to restart
   
5. 
   Go ahead and restart Eclipse when prompted to
   

4. 
   Install Android SDK Components
   

1. 
   Open Eclipse, click “Window” > “Android SDK and AVD Manager”
   
2. 
   In “Available packages”, select the platforms you want to support. You can either choose all, or pick-and-choose what you want to develop for.
   
3. 
   In the “Third party Add-ons”, decide what you are interested in. The Google APIs must be installed.
   
4. 
   Choose “Install Selected”, then the “Accept All” radio button, then “Install”.
   

E) Setup proxy in the Mobile networks setting. (If the UMD-Wireless or UMD-Secure cannot work, please do this experiment in the other Wi-Fi environment.)

1) Create New AVD, select Window > AVD Manager > New. The new Android Virtual Device should set the Android Virtual Device (AVD) as showed below. (Noted: the AVD showed just for reference, you could create different as long as the experiment could be run.)

Figure 1. AVD setting details

2. 
   Use real mobile device
   

Figure 2. Capture.apk location

2) Copy this .apk file to the Android device, for example, pause in Downloads folder. Then open Downloads, tap on the APK file, and tap Yes when prompted. The app will begin installing on device.

3.2 Set up project into Eclipse

1. 
   Import the project package to Eclipse. (Shown as Figure 1)
   

Figure 3.

2. 
   Set how to import the project package, choose Existing Android Code Into Workspace
   

Figure 4.

Choose Browse>Select the project package which provided>Finish

3. 
   Success import in the Android projects.
   

Figure 5.

3. 
   Add malicious code
   

…

…

3. 
   Test an attack success or not
   

1. 
   The Login page
   

Figure 6.

2. 
   User type in the personal information
   

Figure 7.

3. 
   Capture the information
   

Figure 8.

Noted: For education purpose, we did not let the malicious app send that information to anyone just show it. In real attack, it should be send to the attacker.

4. Reference

[2] T. Luo, H. Hao, W. Du, Y. Wang, H. Yin. “Why Eve and Mallory Love Android: An Analysis of Android SSL (in) Security”

[3] http://www.eclipse.org/, “Eclipse official website”

[4] http://theopentutorials.com/tutorials/android/how-to-create-android-avd-emulator-in-eclipse/, “How to create and launch emulator in Eclipse”